Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 15:02
Static task
static1
Behavioral task
behavioral1
Sample
6FC817F7C53BEEA30C55D55779CEF31D.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6FC817F7C53BEEA30C55D55779CEF31D.exe
Resource
win10v2004-20240226-en
General
-
Target
6FC817F7C53BEEA30C55D55779CEF31D.exe
-
Size
467KB
-
MD5
6fc817f7c53beea30c55d55779cef31d
-
SHA1
ec9f6005ccbc9b8f3286445e9d071c3f3751d52b
-
SHA256
9be6abe91db5212e333a086a8f9db157c08f7cf1eeb9020f6cf13444ddab8036
-
SHA512
5ecbe0be020007f8deb7b9471a23345863368a149790ca026517831339d167c37a50c65a91c449cdae1d090d17cc31638298fa5a98ac99feff6f77587cbea0f4
-
SSDEEP
6144:j2OGscfKNO6bRDnqY9Nt3o9LresPnp4v26BEWwmJR5QeV3rQCVsOI0XlAU9k:27fKNx9+Wz0OsKVElwLVO0XlF9k
Malware Config
Extracted
netwire
dnsresoIve.ns01.US:15111
dnsresolve.srz2l6.com:15111
PLUGINUPDATES.duckdns.org:15111
updateavlocalgenuine.com:15111
localupdate.ns02.info:15111
dnsresolve.nsl1.cc:15111
dnsresolve.srs8l2.com:15111
-
activex_autorun
false
-
activex_key
{A3N5KUJ4-U7S4-6J45-1DJ6-32HM4W8Q0615}
-
copy_executable
false
-
delete_original
false
-
host_id
AVR-UAW0oo
-
lock_executable
false
-
offline_keylogger
false
-
password
DuleX
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4428-8-0x0000000000400000-0x000000000046D000-memory.dmp netwire -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
6FC817F7C53BEEA30C55D55779CEF31D.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3N5KUJ4-U7S4-6J45-1DJ6-32HM4W8Q0615}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6FC817F7C53BEEA30C55D55779CEF31D.exe\"" 6FC817F7C53BEEA30C55D55779CEF31D.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3N5KUJ4-U7S4-6J45-1DJ6-32HM4W8Q0615} 6FC817F7C53BEEA30C55D55779CEF31D.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6FC817F7C53BEEA30C55D55779CEF31D.exedescription pid process target process PID 1904 set thread context of 4428 1904 6FC817F7C53BEEA30C55D55779CEF31D.exe 6FC817F7C53BEEA30C55D55779CEF31D.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
6FC817F7C53BEEA30C55D55779CEF31D.exedescription pid process target process PID 1904 wrote to memory of 4428 1904 6FC817F7C53BEEA30C55D55779CEF31D.exe 6FC817F7C53BEEA30C55D55779CEF31D.exe PID 1904 wrote to memory of 4428 1904 6FC817F7C53BEEA30C55D55779CEF31D.exe 6FC817F7C53BEEA30C55D55779CEF31D.exe PID 1904 wrote to memory of 4428 1904 6FC817F7C53BEEA30C55D55779CEF31D.exe 6FC817F7C53BEEA30C55D55779CEF31D.exe PID 1904 wrote to memory of 4428 1904 6FC817F7C53BEEA30C55D55779CEF31D.exe 6FC817F7C53BEEA30C55D55779CEF31D.exe PID 1904 wrote to memory of 4428 1904 6FC817F7C53BEEA30C55D55779CEF31D.exe 6FC817F7C53BEEA30C55D55779CEF31D.exe PID 1904 wrote to memory of 4428 1904 6FC817F7C53BEEA30C55D55779CEF31D.exe 6FC817F7C53BEEA30C55D55779CEF31D.exe PID 1904 wrote to memory of 4428 1904 6FC817F7C53BEEA30C55D55779CEF31D.exe 6FC817F7C53BEEA30C55D55779CEF31D.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6FC817F7C53BEEA30C55D55779CEF31D.exe"C:\Users\Admin\AppData\Local\Temp\6FC817F7C53BEEA30C55D55779CEF31D.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6FC817F7C53BEEA30C55D55779CEF31D.exe"C:\Users\Admin\AppData\Local\Temp\6FC817F7C53BEEA30C55D55779CEF31D.exe"2⤵
- Modifies Installed Components in the registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1904-0-0x0000000002210000-0x0000000002211000-memory.dmpFilesize
4KB
-
memory/1904-6-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/4428-1-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/4428-2-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/4428-5-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/4428-8-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB